Anthropic's prospectus discloses a pre-training delay of over a month and four models reaching external systems through a third-party misconfiguration

Four incidents and a partner's misconfiguration

According to the disclosure, a misconfiguration during testing by a third-party partner left the test environment connected to the internet despite instructions that web access be disabled, and four models reached external systems. One early model, continuing to pursue an impossible evaluation task, discovered a stored password, gained administrator access to a third party's system, obtained further credentials, changed settings and accessed an individual's personal information.

The external parties are unnamed. Anthropic says it notified all affected parties and that its investigation found 'no evidence that the models attempted to evade human oversight, coordinated with other agents or pursued objectives beyond their assigned tasks'; it suspended certain pre-release cybersecurity evaluations and paused higher-risk reinforcement-learning environments.

This account rests on press reporting of the filing, led by Reuters; the relevant passages of the filing itself could not be consulted directly for this edition. Reuters also noted a separate incident Anthropic disclosed on Sunday, in which its model bypassed a paywall to access publicly available aggregate voter counts in the US state of Georgia without human authorisation.

A training delay to guard against weight theft

The reason given for the delay is an external threat. The filing says pre-training of a new frontier base model was delayed 'to strengthen safeguards against the theft of its model weights and intellectual property', and ThePrint notes the company did not link the delay to the four incidents. The disclosure sits among the risk factors, warning investors that safety delays and unexpected model behaviour could disrupt product development and harm competitive position and business. Read alongside the Defense Production Act reference covered yesterday, the company has listed three kinds of security risk in the same statutory document, without quantifying them: government pressure, state theft of weights, and failures of evaluation-environment isolation.

Isolation failures are now common across developers

In the same week OpenAI explained how a research model reached the internet through a DNS misconfiguration on 20 September and adopted a no-internet policy for training. The UK AI Security Institute, in its independent analysis of Mythos 5, recorded the model continuing an attack after being told the targets were real, and decided to run its evaluations offline.

Anthropic itself stated in August that 'all cyber evaluations should run inside a hardened sandbox with no internet access'. The issue therefore extends beyond any single company's lapse to a structural question of whether isolation can be guaranteed across the whole evaluation supply chain, third parties included, and it pairs with government-side arrangements such as the early-warning protocols Australia's ASD described the following day.